Analysis

  • max time kernel
    144s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    30/09/2023, 06:54 UTC

General

  • Target

    4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe

  • Size

    1.3MB

  • MD5

    851e5c879e22248f985170716734c35f

  • SHA1

    62e337a35f602214df52b0de96a45ce28b636e70

  • SHA256

    4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97

  • SHA512

    ab8b494895d27eb8f12beecbd412fb9653ffcc1b6ef5a35c8eec8c9bbe3355e0e8d6a4cad47ad5a3dc05c42065d208ec91ebdcef50f77809cf6fea6573201070

  • SSDEEP

    24576:TVP4iQzePuruuXj/cjtkugLwnNM9bEjryZFmTcHAdyZbX62z9tywY3+Q:TWBj/cjt1OwNMhS+ZLgdIbX6K9tywq+

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe
    "C:\Users\Admin\AppData\Local\Temp\4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Users\Admin\AppData\Local\Temp\4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe
      PECMD**pecmd-cmd* PUTF "C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe",,"C:\Users\Admin\AppData\Local\Temp\4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe""#102|SCRIPT"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3060
    • C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2360
      • C:\Windows\svchost.exe
        "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe
          "C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          PID:2144
    • C:\Users\Admin\AppData\Local\Temp\4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe
      PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~55146968188629411.cmd"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1340
      • C:\Windows\system32\cmd.exe
        cmd /c "C:\Users\Admin\AppData\Local\Temp\~55146968188629411.cmd"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:632
        • C:\Windows\system32\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:1636
        • C:\Windows\system32\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:1520
        • C:\Windows\system32\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:2100
        • C:\Windows\system32\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:2780
  • C:\Windows\svchost.exe
    C:\Windows\svchost.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:1796

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~55146968188629411.cmd

    Filesize

    404B

    MD5

    eefd2ab70bd575260278921a63f2d16a

    SHA1

    946e3dcf1473ebbb6353f4e13664631d44bf26d1

    SHA256

    7e03671bf877b42aac92b5523ef8866ae73637cb90794f22ed46ab58f5742030

    SHA512

    6a81b3555d5f23e3799e2515a546aaa072b7a8b031513fa0fc69c2414ef848a510209d3e0f781554d120851598d75690fabf789699e026731732bd0f6ee3b6ea

  • C:\Users\Admin\AppData\Local\Temp\~55146968188629411.cmd

    Filesize

    404B

    MD5

    eefd2ab70bd575260278921a63f2d16a

    SHA1

    946e3dcf1473ebbb6353f4e13664631d44bf26d1

    SHA256

    7e03671bf877b42aac92b5523ef8866ae73637cb90794f22ed46ab58f5742030

    SHA512

    6a81b3555d5f23e3799e2515a546aaa072b7a8b031513fa0fc69c2414ef848a510209d3e0f781554d120851598d75690fabf789699e026731732bd0f6ee3b6ea

  • C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe

    Filesize

    1013KB

    MD5

    a681dcd188b1845fda9f078c1a3b2138

    SHA1

    c8552e6bd406397323490a2b01792f8878588183

    SHA256

    ebacd005c0b543bbf6fa1a8468285258be60c2b201ccf6e7b972f8f4645c4443

    SHA512

    350cc3e979c897af62271d6902b5598d8c5610524f45983913870f2aff62bf2552f552eb8894f74238fdfca565e769a605f48ddf3c8ff97a32f137ab5ea142bf

  • C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe

    Filesize

    1013KB

    MD5

    a681dcd188b1845fda9f078c1a3b2138

    SHA1

    c8552e6bd406397323490a2b01792f8878588183

    SHA256

    ebacd005c0b543bbf6fa1a8468285258be60c2b201ccf6e7b972f8f4645c4443

    SHA512

    350cc3e979c897af62271d6902b5598d8c5610524f45983913870f2aff62bf2552f552eb8894f74238fdfca565e769a605f48ddf3c8ff97a32f137ab5ea142bf

  • C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe

    Filesize

    1.0MB

    MD5

    1d886abc09404b92a7ff409f702ab5e3

    SHA1

    0ce1d79cecd30972f65ba36ba8764a61c59bbfaa

    SHA256

    313000d7b516c9213eea24411c564e65fd717819f678f702efeb8e485b06a66b

    SHA512

    276db90a7ad862afeb37e2a205276979603507f8d4a56b86bb114931db9f65f902e4643220737c8eb86829457273b838f26585da14cb766cfe432d2297975f92

  • C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe

    Filesize

    1.0MB

    MD5

    1d886abc09404b92a7ff409f702ab5e3

    SHA1

    0ce1d79cecd30972f65ba36ba8764a61c59bbfaa

    SHA256

    313000d7b516c9213eea24411c564e65fd717819f678f702efeb8e485b06a66b

    SHA512

    276db90a7ad862afeb37e2a205276979603507f8d4a56b86bb114931db9f65f902e4643220737c8eb86829457273b838f26585da14cb766cfe432d2297975f92

  • C:\Windows\svchost.exe

    Filesize

    35KB

    MD5

    13e083a9d53e948803694a603e69081a

    SHA1

    5f0926b43c970edad8b969cbec9cfebb5ad0a971

    SHA256

    305485ffc5c72617b5b4d6af8a69bc77574c05df4b21829e08bb3a6a2ffd16c5

    SHA512

    a2b4073ba2edafae7f276c2fb1279dd19f2be6dbe67ed1c9f94a082afca70286493b9c33e1fb705d7e1bab3fe66afc84173e9490751611b5c628970892d08814

  • C:\Windows\svchost.exe

    Filesize

    35KB

    MD5

    13e083a9d53e948803694a603e69081a

    SHA1

    5f0926b43c970edad8b969cbec9cfebb5ad0a971

    SHA256

    305485ffc5c72617b5b4d6af8a69bc77574c05df4b21829e08bb3a6a2ffd16c5

    SHA512

    a2b4073ba2edafae7f276c2fb1279dd19f2be6dbe67ed1c9f94a082afca70286493b9c33e1fb705d7e1bab3fe66afc84173e9490751611b5c628970892d08814

  • C:\Windows\svchost.exe

    Filesize

    35KB

    MD5

    13e083a9d53e948803694a603e69081a

    SHA1

    5f0926b43c970edad8b969cbec9cfebb5ad0a971

    SHA256

    305485ffc5c72617b5b4d6af8a69bc77574c05df4b21829e08bb3a6a2ffd16c5

    SHA512

    a2b4073ba2edafae7f276c2fb1279dd19f2be6dbe67ed1c9f94a082afca70286493b9c33e1fb705d7e1bab3fe66afc84173e9490751611b5c628970892d08814

  • C:\Windows\svchost.exe

    Filesize

    35KB

    MD5

    13e083a9d53e948803694a603e69081a

    SHA1

    5f0926b43c970edad8b969cbec9cfebb5ad0a971

    SHA256

    305485ffc5c72617b5b4d6af8a69bc77574c05df4b21829e08bb3a6a2ffd16c5

    SHA512

    a2b4073ba2edafae7f276c2fb1279dd19f2be6dbe67ed1c9f94a082afca70286493b9c33e1fb705d7e1bab3fe66afc84173e9490751611b5c628970892d08814

  • \Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe

    Filesize

    1013KB

    MD5

    a681dcd188b1845fda9f078c1a3b2138

    SHA1

    c8552e6bd406397323490a2b01792f8878588183

    SHA256

    ebacd005c0b543bbf6fa1a8468285258be60c2b201ccf6e7b972f8f4645c4443

    SHA512

    350cc3e979c897af62271d6902b5598d8c5610524f45983913870f2aff62bf2552f552eb8894f74238fdfca565e769a605f48ddf3c8ff97a32f137ab5ea142bf

  • \Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe

    Filesize

    1.0MB

    MD5

    1d886abc09404b92a7ff409f702ab5e3

    SHA1

    0ce1d79cecd30972f65ba36ba8764a61c59bbfaa

    SHA256

    313000d7b516c9213eea24411c564e65fd717819f678f702efeb8e485b06a66b

    SHA512

    276db90a7ad862afeb37e2a205276979603507f8d4a56b86bb114931db9f65f902e4643220737c8eb86829457273b838f26585da14cb766cfe432d2297975f92

  • memory/1340-47-0x0000000000400000-0x00000000005D8000-memory.dmp

    Filesize

    1.8MB

  • memory/1340-46-0x0000000000400000-0x00000000005D8000-memory.dmp

    Filesize

    1.8MB

  • memory/1796-28-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/1796-64-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/1796-49-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/2196-44-0x0000000002430000-0x0000000002608000-memory.dmp

    Filesize

    1.8MB

  • memory/2196-7-0x00000000003A0000-0x00000000003DF000-memory.dmp

    Filesize

    252KB

  • memory/2196-1-0x0000000002430000-0x0000000002608000-memory.dmp

    Filesize

    1.8MB

  • memory/2196-0-0x0000000000400000-0x00000000005D8000-memory.dmp

    Filesize

    1.8MB

  • memory/2196-45-0x0000000000400000-0x00000000005D8000-memory.dmp

    Filesize

    1.8MB

  • memory/2360-15-0x0000000000020000-0x000000000002D000-memory.dmp

    Filesize

    52KB

  • memory/2360-18-0x0000000000020000-0x000000000002D000-memory.dmp

    Filesize

    52KB

  • memory/2360-60-0x0000000000020000-0x000000000002D000-memory.dmp

    Filesize

    52KB

  • memory/2360-14-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/2740-19-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/2740-29-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/3060-2-0x0000000000400000-0x00000000005D8000-memory.dmp

    Filesize

    1.8MB

  • memory/3060-4-0x0000000000400000-0x00000000005D8000-memory.dmp

    Filesize

    1.8MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.